Firewalls were developed to protect networks from unauthorized accesses. Hackers, corporate spies, political spies, and others may attempt to penetrate a network to obtain sensitive information or disrupt the functioning of the network. To guard against these dangers, firewalls inspect packets and sessions to determine if they should be transmitted or dropped. In effect, firewalls have become a single point of network access where traffic can be analyzed and controlled according to parameters such as application, address, and user, for both incoming traffic from remote users and outgoing traffic to the Internet.
Firewalls most commonly exist at points where private networks meet public ones, such as a corporate Internet access point. However, firewalls can also be appropriate in an organization's network, to protect sensitive resources such as engineering workgroup servers or financial databases from unauthorized users.
Policy based packet filtering firewalls employs a list of permissible packet types from external sources. This list typically includes information that may be checked in a packet header. The firewall checks each received packet to determine whether it meets the acceptance criteria for an incoming packet. If the packet doesn't meet the criteria, the firewall immediately rejects the packet. A similar mechanism can be provided for transmitted packets, as well.
Often, the firewall maintains the access criteria as an access control list. This access control criteria may contain network and transport layer information such as addresses and ports for acceptable sources and destination pairs. The firewall checks packet headers for source and destination addresses and source and destination ports, if necessary, to determine whether the information conforms to any of the stored access control criteria. From this, the firewall determines which packets are to be forwarded and which are to be discarded. Some extended access lists can also examine transport-layer information to determine whether to forward or block packets.
While packet filtering is considered to be significantly fast, it isn't, however, very good at handling protocols that create multiple IP addresses for mobile user devices that, typically, go in and out a networking environment. Transport Control Protocol (“TCP”) and STMP (used in electronic mail) uses a similar single well-known source-destination access mechanism. For such cases, the packet filtering mechanism employs an access control list that includes the necessary elements or parameters that defines the allowed or permitted access to the network via a specific IP address. As a result, these IP addresses, never changes, the access control lists is initially set and left unchanged throughout the life of the firewall. Therefore, the packet filtering mechanism is static and as such, must either block all use of this protocol or allow all use, regardless of IP addresses. This represents a significant limitation of packet filtering mechanisms.
Fundamentally, there are two approaches that can be suggested for solving the problem of updating the attributes used to generate the packet filters of a firewall that permits the opening and removing or closing of “pinholes” that supports a plurality of mobile terminal devices moving in and out or around a network. One approach is to have a mobile terminal initiate a configuration protocol that closes the pinholes for a particular IP address of a terminal device that is moving to another portion of the network and then creates the filtering parameters for the pinholes of a new IP address when that terminal device “reenters” the network again. Thus, if there are a significant number rules or attributes associated with a set of corresponding packet filters or “pinholes”, the terminal device must close these “pinhole” before it can generate a new set of rules to open a new set of packet filters or “pinholes” that are associated with a new IP address. As a result, the closing, generating a series of new packet filters or “pinholes” and installing a series of new rules appropriate for these new packet filters or “pinholes” might take an inordinately length of time which, in turn, might cause incoming packets to be dropped and discarded. More specifically, in Transport Control Protocol (“TCP”) networking environments, packet filters are typically used to inspect and verify the validity of the TCP sequence number of incoming packets, closing existing “pinhole” and opening new “pinholes” may cause some synchronization problems between the TCP sequence number found in the packets and in the firewall. As a result, these incoming packets may be dropped during that time.
Therefore, the need has been recognized by a number of standards organizations such as the Internet Engineering Task Force (IETF) that has specified the parameters and attributes for several of the Internet protocols. One such protocol defined is called the Middlebox Communications Architecture (MIDCOM) that allows application servers (AS) to “open and remove” pinholes, creating a particular packet filter having the appropriate attributes so that the packets, for example, containing such elements as an audio/video data stream or application content is able to pass through the firewall and be delivered to a specific user residing on the network. However, the MIDCOM approach relies on application servers to “create and remove” pinholes rather than the user who is, typically, the only one that understands the detail needed for such communications. In other words, a server may not know all the attributes for a particular set of pinholes or packet filters required to receive a specified stream of packets, and as a result, the firewall is not configured properly. As a consequence, the characteristics of the incoming packets (IP/TCP header) do not match the pinholes and as a result the received packets are discarded.
Due to the development of new applications such as VoIP (Voice over IP), there is a requirement to create a new approach or means of modifying, creating or re-defining the packet filtering mechanism of a network firewall. Therefore there is a requirement for a technique that allows the opening and closing access to a network by efficiently creating the rules that can be used to generate new packet filters or “pinholes” in a firewall that permits delivery of such things as a video/audio stream, for example. Without the ability of dynamically changing the specific parameters or attributes in the packet filtering methodology of a firewall, inbound packets containing desired data or application content might be disposed of right at the firewall.
For the above and other reasons, it would be desirable to have an improved mechanism by which the parameters or attributes of the packet filters of a firewall can be updated or modified to accommodate the requirements of mobile user.